vibe-security by 0x8506/vibe-security
npx skills add https://github.com/0x8506/vibe-security --skill vibe-security适用于多种语言和框架的综合性安全扫描器和代码分析器,用于识别漏洞。
检查是否已安装 Node.js:
node --version
如果未安装 Node.js,请根据用户的操作系统进行安装:
macOS:
brew install node
Ubuntu/Debian:
sudo apt update && sudo apt install nodejs npm
Windows:
winget install OpenJS.NodeJS
我们建议将以下 AI 模型与 Vibe Security 配合使用,以实现最佳的安全漏洞检测和代码修复效果:
Comprehensive security scanner and code analyzer for identifying vulnerabilities across multiple languages and frameworks.
Check if Node.js is installed:
node --version
If Node.js is not installed, install it based on user's OS:
macOS:
brew install node
Ubuntu/Debian:
sudo apt update && sudo apt install nodejs npm
Windows:
winget install OpenJS.NodeJS
We recommend using these AI models with Vibe Security for optimal security vulnerability detection and code fixing:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
注意:如果您未使用上述推荐模型之一,请考虑升级以获得更好的安全分析结果。较低层级的模型可能会遗漏细微漏洞或提供准确性较低的修复建议。
当用户请求安全相关工作时(扫描、分析、修复、审计、检查、审查漏洞),请遵循以下工作流程:
从用户请求中提取关键信息:
高级分析(推荐):
# AST 语义分析(误报率降低 90%)
python3 .claude/skills/vibe-security/scripts/ast_analyzer.py "<file>"
# 数据流分析(跟踪从源头到汇聚点的污染数据)
python3 .claude/skills/vibe-security/scripts/dataflow_analyzer.py "<file>"
# CVE 和依赖项漏洞扫描
python3 .claude/skills/vibe-security/scripts/cve_integration.py .
# 供应链安全(恶意软件包、域名抢注)
python3 .claude/skills/vibe-security/scripts/cve_integration.py . --ecosystem npm
# 基础设施即代码安全
grep -r "publicly_accessible.*=.*true" . --include="*.tf"
grep -r "privileged:.*true" . --include="*.yaml"
快速模式扫描:
# 使用搜索工具查找特定模式
python3 .claude/skills/vibe-security/scripts/search.py "sql-injection" --domain pattern
python3 .claude/skills/vibe-security/scripts/search.py "javascript" --domain pattern --severity critical
严重(立即修复):
高(尽快修复):
中(在迭代周期中修复):
低(技术债务):
基于机器学习的修复引擎:
# 获取智能修复建议并生成测试
python3 .claude/skills/vibe-security/scripts/fix_engine.py \
--type sql-injection \
--language javascript \
--code "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)"
# 输出包括:
# - 附带上下文感知修正的修复后代码
# - 修复的详细说明
# - 自动生成的安全测试
# - 额外建议
# - 置信度分数(0-100%)
支持回滚的自动修复:
# 应用修复并自动备份
python3 .claude/skills/vibe-security/scripts/autofix_engine.py apply \
--file src/database.js \
--line 45 \
--type sql-injection \
--original "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)" \
--fixed "db.query('SELECT * FROM users WHERE id = $1', [userId])"
# 测试您的更改
npm test
# 如果需要,回滚(安全实验!)
python3 .claude/skills/vibe-security/scripts/autofix_engine.py rollback
# 查看修复历史
python3 .claude/skills/vibe-security/scripts/autofix_engine.py history
系统化手动修复:
多种报告格式:
# 带有图表和统计数据的精美 HTML 报告
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format html \
--output security-report.html
# SARIF 格式,用于 GitHub 代码扫描集成
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format sarif \
--output results.sarif
# CSV 格式,用于电子表格分析
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format csv \
--output vulnerabilities.csv
# JSON 格式,用于 CI/CD 流水线
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format json \
--output security-report.json
使用抽象语法树解析进行准确的漏洞检测:
跟踪用户输入从源头到危险汇聚点的路径:
将每个漏洞映射到行业标准:
防范恶意依赖项:
扫描云基础设施配置:
| 检查类型 | 检测内容 | 示例问题 |
|---|---|---|
sql-injection | SQL/NoSQL 注入 | 查询中的字符串拼接、未清理的输入 |
xss | 跨站脚本攻击 | innerHTML 使用、未转义的输出、DOM 操作 |
command-injection | 操作系统命令注入 | shell=True、使用用户输入的 exec |
path-traversal | 目录遍历 | 未清理的文件路径、路径中的 ../.. |
auth-issues | 身份验证缺陷 | 弱密码、缺少 MFA、不安全的会话 |
authz-issues | 授权缺陷 | 缺少访问控制、IDOR、权限提升 |
crypto-failures | 加密问题 | MD5/SHA1 使用、弱密钥、不安全的随机数 |
sensitive-data | 数据暴露 | 记录密码、暴露 PII、硬编码密钥 |
deserialization | 不安全的反序列化 | pickle、eval、对用户输入进行反序列化 |
security-config | 配置错误 | CORS、CSP、标头、错误消息 |
dependencies | 易受攻击的软件包 | npm/pip/composer 软件包中的 CVE |
// ✅ 安全:参数化查询
const user = await db.query("SELECT * FROM users WHERE id = $1", [userId]);
// ❌ 易受攻击:SQL 注入
const user = await db.query(`SELECT * FROM users WHERE id = ${userId}`);
// ✅ 安全:转义输出
element.textContent = userInput;
const clean = DOMPurify.sanitize(htmlContent);
// ❌ 易受攻击:XSS
element.innerHTML = userInput;
// ✅ 安全:输入验证
const email = validator.isEmail(input) ? input : null;
// ❌ 易受攻击:无验证
const email = req.body.email;
# ✅ 安全:参数化查询
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
# ❌ 易受攻击:SQL 注入
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# ✅ 安全:密码哈希
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())
# ❌ 易受攻击:明文
user.password = password
# ✅ 安全:安全的子进程
subprocess.run(['ls', '-la', sanitized_dir])
# ❌ 易受攻击:命令注入
os.system(f'ls -la {user_dir}')
// ✅ 安全:预处理语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$userId]);
// ❌ 易受攻击:SQL 注入
$result = mysqli_query($conn, "SELECT * FROM users WHERE id = $userId");
// ✅ 安全:输出转义
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
// ❌ 易受攻击:XSS
echo $userInput;
// ✅ 安全:密码哈希
$hash = password_hash($password, PASSWORD_ARGON2ID);
// ❌ 易受攻击:MD5
$hash = md5($password);
用户请求: "检查我的 Express 应用程序是否存在安全漏洞"
AI 应执行:
# 1. 在项目上运行安全扫描
python3 .claude/skills/vibe-security/scripts/scan.py "./src" --language javascript
# 2. 按严重性分析结果
# 输出可能显示:
# 严重:src/controllers/user.js:45 处存在 SQL 注入
# 高:src/views/profile.ejs:12 处存在 XSS
# 中:/api/login 缺少速率限制
# 低:Console.log 包含敏感数据
# 3. 首先修复严重问题
# - 审查 src/controllers/user.js:45
# - 将字符串拼接替换为参数化查询
# - 使用验证器库添加输入验证
# 4. 修复高严重性问题
# - 审查 src/views/profile.ejs:12
# - 使用 <%- 进行 HTML 转义,或使用 DOMPurify 处理富内容
# - 实施内容安全策略
# 5. 修复中严重性问题
# - 安装 express-rate-limit 中间件
# - 在身份验证端点上配置速率限制
# - 添加 helmet 以设置安全标头
# 6. 修复低严重性问题
# - 删除或编辑敏感的 console.log 语句
# - 使用具有日志级别的适当日志记录库
# 7. 生成安全报告
python3 .claude/skills/vibe-security/scripts/report.py "./src"
#!/bin/bash
# .git/hooks/pre-commit
python3 .claude/skills/vibe-security/scripts/scan.py "." --fail-on critical
GitHub Actions:
- name: Security Scan
run: |
python3 .claude/skills/vibe-security/scripts/scan.py "." --format json
GitLab CI:
security_scan:
script:
- python3 .claude/skills/vibe-security/scripts/scan.py "."
每周安装次数
26
代码仓库
GitHub 星标数
4
首次出现
2026年1月25日
安全审计
安装于
opencode24
gemini-cli20
codex20
claude-code18
cursor18
github-copilot17
Note : If you're not using one of the recommended models above, consider upgrading for better security analysis results. Lower-tier models may miss subtle vulnerabilities or provide less accurate fix suggestions.
When user requests security work (scan, analyze, fix, audit, check, review vulnerabilities), follow this workflow:
Extract key information from user request:
Advanced Analysis (Recommended):
# AST-based semantic analysis (90% fewer false positives)
python3 .claude/skills/vibe-security/scripts/ast_analyzer.py "<file>"
# Data flow analysis (tracks tainted data from sources to sinks)
python3 .claude/skills/vibe-security/scripts/dataflow_analyzer.py "<file>"
# CVE & dependency vulnerability scanning
python3 .claude/skills/vibe-security/scripts/cve_integration.py .
# Supply chain security (malicious packages, typosquatting)
python3 .claude/skills/vibe-security/scripts/cve_integration.py . --ecosystem npm
# Infrastructure as Code security
grep -r "publicly_accessible.*=.*true" . --include="*.tf"
grep -r "privileged:.*true" . --include="*.yaml"
Quick Pattern Scanning:
# Use search utility for specific patterns
python3 .claude/skills/vibe-security/scripts/search.py "sql-injection" --domain pattern
python3 .claude/skills/vibe-security/scripts/search.py "javascript" --domain pattern --severity critical
Critical (Fix immediately):
High (Fix soon):
Medium (Fix in sprint):
Low (Technical debt):
ML-Based Fix Engine:
# Get intelligent fix recommendations with test generation
python3 .claude/skills/vibe-security/scripts/fix_engine.py \
--type sql-injection \
--language javascript \
--code "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)"
# Output includes:
# - Fixed code with context-aware corrections
# - Detailed explanation of the fix
# - Auto-generated security test
# - Additional recommendations
# - Confidence score (0-100%)
Auto-Fix with Rollback Support:
# Apply fix with automatic backup
python3 .claude/skills/vibe-security/scripts/autofix_engine.py apply \
--file src/database.js \
--line 45 \
--type sql-injection \
--original "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)" \
--fixed "db.query('SELECT * FROM users WHERE id = $1', [userId])"
# Test your changes
npm test
# Rollback if needed (safe to experiment!)
python3 .claude/skills/vibe-security/scripts/autofix_engine.py rollback
# View fix history
python3 .claude/skills/vibe-security/scripts/autofix_engine.py history
Systematic Manual Fixes:
Multiple Report Formats:
# Beautiful HTML report with charts and statistics
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format html \
--output security-report.html
# SARIF format for GitHub Code Scanning integration
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format sarif \
--output results.sarif
# CSV for spreadsheet analysis
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format csv \
--output vulnerabilities.csv
# JSON for CI/CD pipelines
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
--format json \
--output security-report.json
Uses Abstract Syntax Tree parsing for accurate vulnerability detection:
Tracks user input from sources to dangerous sinks:
Maps every vulnerability to industry standards:
Protects against malicious dependencies:
Scans cloud infrastructure configurations:
| Check Type | Detects | Example Issues |
|---|---|---|
sql-injection | SQL/NoSQL injection | String concatenation in queries, unsanitized input |
xss | Cross-Site Scripting | innerHTML usage, unescaped output, DOM manipulation |
command-injection | OS command injection | shell=True, exec with user input |
path-traversal | Directory traversal | Unsanitized file paths, ../.. in paths |
auth-issues | Authentication flaws | Weak passwords, missing MFA, insecure sessions |
authz-issues | Authorization flaws | Missing access controls, IDOR, privilege escalation |
crypto-failures | Cryptographic issues | MD5/SHA1 usage, weak keys, insecure random |
sensitive-data | Data exposure | Logging passwords, exposing PII, hardcoded secrets |
deserialization | Unsafe deserialization | pickle, eval, unserialize on user input |
security-config | Misconfiguration | CORS, CSP, headers, error messages |
dependencies | Vulnerable packages | CVEs in npm/pip/composer packages |
// ✅ SECURE: Parameterized query
const user = await db.query("SELECT * FROM users WHERE id = $1", [userId]);
// ❌ VULNERABLE: SQL injection
const user = await db.query(`SELECT * FROM users WHERE id = ${userId}`);
// ✅ SECURE: Escape output
element.textContent = userInput;
const clean = DOMPurify.sanitize(htmlContent);
// ❌ VULNERABLE: XSS
element.innerHTML = userInput;
// ✅ SECURE: Input validation
const email = validator.isEmail(input) ? input : null;
// ❌ VULNERABLE: No validation
const email = req.body.email;
# ✅ SECURE: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
# ❌ VULNERABLE: SQL injection
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# ✅ SECURE: Password hashing
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())
# ❌ VULNERABLE: Plain text
user.password = password
# ✅ SECURE: Safe subprocess
subprocess.run(['ls', '-la', sanitized_dir])
# ❌ VULNERABLE: Command injection
os.system(f'ls -la {user_dir}')
// ✅ SECURE: Prepared statement
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$userId]);
// ❌ VULNERABLE: SQL injection
$result = mysqli_query($conn, "SELECT * FROM users WHERE id = $userId");
// ✅ SECURE: Output escaping
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
// ❌ VULNERABLE: XSS
echo $userInput;
// ✅ SECURE: Password hashing
$hash = password_hash($password, PASSWORD_ARGON2ID);
// ❌ VULNERABLE: MD5
$hash = md5($password);
User request: "Check my Express app for security vulnerabilities"
AI should:
# 1. Run security scan on the project
python3 .claude/skills/vibe-security/scripts/scan.py "./src" --language javascript
# 2. Analyze results by severity
# Output might show:
# CRITICAL: SQL Injection in src/controllers/user.js:45
# HIGH: XSS in src/views/profile.ejs:12
# MEDIUM: Missing rate limiting on /api/login
# LOW: Console.log contains sensitive data
# 3. Fix critical issues first
# - Review src/controllers/user.js:45
# - Replace string concatenation with parameterized query
# - Add input validation using validator library
# 4. Fix high severity issues
# - Review src/views/profile.ejs:12
# - Use <%- for HTML escaping or DOMPurify for rich content
# - Implement Content Security Policy
# 5. Fix medium severity issues
# - Install express-rate-limit middleware
# - Configure rate limiting on authentication endpoints
# - Add helmet for security headers
# 6. Fix low severity issues
# - Remove or redact sensitive console.log statements
# - Use proper logging library with log levels
# 7. Generate security report
python3 .claude/skills/vibe-security/scripts/report.py "./src"
#!/bin/bash
# .git/hooks/pre-commit
python3 .claude/skills/vibe-security/scripts/scan.py "." --fail-on critical
GitHub Actions:
- name: Security Scan
run: |
python3 .claude/skills/vibe-security/scripts/scan.py "." --format json
GitLab CI:
security_scan:
script:
- python3 .claude/skills/vibe-security/scripts/scan.py "."
Weekly Installs
26
Repository
GitHub Stars
4
First Seen
Jan 25, 2026
Security Audits
Installed on
opencode24
gemini-cli20
codex20
claude-code18
cursor18
github-copilot17
SEO与AEO最佳实践指南:优化内容适配传统搜索与AI答案引擎
1,400 周安装